<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('modify.content'); $itemId = (int)($_POST['item_id'] ?? 0); $width = max(1, min(3, (int)($_POST['slot_width'] ?? 1))); if (!$itemId) { exit(json_encode(['success' => false, 'error' => 'item_id required'])); } Database::execute("UPDATE order_items SET slot_width = :w WHERE id = :id", [':w' => $width, ':id' => $itemId]); exit(json_encode(['success' => true, 'slot_width' => $width])); 